WhatsApp had hidden instructions on its help pages that told its AI support chatbot not to recommend privacy regulators to users who couldn’t delete their accounts.
Other instructions barred the chatbot from discussing privacy laws once a user mentioned legal action, even when the user raised those laws directly.
The findings were published by Redact founder and CEO Dan Saltman, whose team discovered the hidden text on October 8, 2026. An examination of all 545 pages linked from WhatsApp’s help center uncovered 102 hidden instruction blocks across 80 pages. The text was in the page code but didn’t appear in the visible articles.
Redact develops tools for deleting posts, messages, and other online data. Its investigation found that most instructions provided routine support guidance, clarified terminology, or discouraged unsafe troubleshooting. Two blocks, however, restricted information about privacy complaints and legal rights.
WhatsApp’s suspicious instructions
One appeared on the account deletion page and addressed users who had lost access to their phone number or device. It directed the chatbot to explain that deactivated accounts are deleted after 30 days, while inactive accounts are generally removed after 120 days, or 365 days for US users.
The same block prohibited recommending a data protection authority, regulator, or supervisory authority. It also told the chatbot not to suggest that WhatsApp could manually delete an account on the user’s behalf.
A second block, on the reporting and blocking page, applied whenever users mentioned lawyers, lawsuits, courts, or other legal proceedings. It prohibited citing or interpreting WhatsApp’s terms, privacy policy, or other legal documents, and discussing the company’s liability.
The restrictions also covered references to privacy regulations, including the GDPR, LGPD, and CCPA, even when users brought them up themselves. Instead, the chatbot was directed to refer legal matters to a qualified professional.
These instructions differed from information in WhatsApp’s European privacy policy, which describes users’ rights to request erasure and complain to Ireland’s Data Protection Commission or another competent supervisory authority.
The distinction matters: declining to promise manual account deletion does not itself remove the right to request erasure. Suppressing regulator referrals, however, could leave users unaware of a complaint route described in WhatsApp’s own policy.
Bug blamed
WhatsApp, Meta’s messaging service, confirmed to WIRED that the instructions were intended for its own AI support chatbot. The company said a bug exposed them on its public help pages and that it had fixed the issue. WhatsApp told the media that its support chatbots should provide relevant help about the service and avoid offering legal advice.
Redact confirmed that all 102 hidden blocks had disappeared by October 18. Archived copies indicate the account deletion instruction was in place by September 4, although its exact introduction date remains unknown.
The investigation did not test whether WhatsApp’s chatbot or outside AI assistants followed the instructions. Removing the public text also does not establish whether the underlying chatbot guidance changed.
Users seeking account deletion should consult WhatsApp’s published privacy policy directly for its stated request and complaint options, rather than relying solely on chatbot responses.
Leave a Reply